Security
ChatMyBank exists to read your bank data on your behalf, so protecting it is the whole job. This page describes how bank connections work, what we can and cannot access, and how your data is protected.
Bank login is handled by Plaid, not by us
When you connect an account you go through Plaid Link. Depending on your bank, you either sign in inside Plaid's secure interface or you are redirected to your bank's own OAuth login page (this is how institutions such as Chase and Bank of America connect). In both cases your online banking username, password and any one-time codes are entered with Plaid or with your bank.
Your bank credentials never reach ChatMyBank. We never see them, never transmit them and have nowhere to store them. What we receive from Plaid is an access token that lets us read the specific accounts you approved, and that token can be revoked by you at any time.
Read-only, by design
We request only Plaid's Accounts, Balance, Transactions products. None of these can initiate a payment, transfer or any other change to your accounts. We deliberately do not use Plaid products such as Auth, Identity or Transfer, which means we do not hold full account or routing numbers and the Service has no technical capability to move money, even if an account were compromised.
What that gives us access to:
- Institution name, account names, types, currency and the last four digits of each account number
- Current and available balances
- Transaction history: dates, amounts, merchant names or descriptions, categories and pending status
How your data is protected
Encryption in transit
All traffic between your browser, your AI tools, our servers and Plaid is encrypted with TLS. We do not serve any part of the product over plain HTTP.
Encryption at rest
Plaid access tokens are encrypted at rest with keys held in a managed secrets store, separate from the database. Databases and backups are encrypted at rest.
Hashed, revocable API keys
API keys are shown to you once, stored only as a hash, and scoped read-only to your own data. You can rotate or revoke them instantly from Settings.
Least-privilege internally
Production access is restricted to the people who need it, protected by multi-factor authentication, and logged. Secrets are never committed to source code.
Monitoring and rate limits
We monitor for unusual access patterns and rate-limit the API and MCP endpoint to make brute-force and scraping attempts impractical.
Minimal data, minimal logs
We request only the Plaid products we need and we do not log the financial data returned in API responses, only request metadata.
Your AI agents and the MCP endpoint
Your hosted MCP endpoint and REST API give tools like Claude, ChatGPT, Cursor or your own agents read-only access to your data, authenticated with your personal key. Treat that key like a password. Every request is tied to your account, rate-limited and logged (metadata only), and you can see and revoke active keys from Settings. If a key is ever exposed, revoke it and issue a new one; the old one stops working immediately.
You stay in control
- Disconnect a bank from Settings at any time. We revoke the Plaid access token immediately and delete the associated data within 30 days.
- Delete your account from Settings and every bank connection is revoked and all of your data is deleted within 30 days, with encrypted backups purged within 90 days.
- Revoke any API key or turn off any alert channel whenever you like.
- You can also manage which apps have access to your bank data from Plaid's own portal at my.plaid.com.
Responsible disclosure
If you believe you have found a security vulnerability in ChatMyBank, please email security@chatmybank.com with enough detail for us to reproduce it. We will acknowledge your report within two business days, keep you informed as we investigate, and will not take legal action against researchers who report in good faith, avoid accessing other people's data, and give us reasonable time to fix the issue before public disclosure.
Questions
Security questions from users, banks or partners are welcome at security@chatmybank.com. For everything else, see our Privacy Policy or contact support.